ubuntu-docker-images team mailing list archive

[Sergio Durigan Junior <sergio.durigan@xxxxxxxxxxxxx>]

On Friday, April 22 2022, Athos Ribeiro wrote:

> On Thu, Apr 21, 2022 at 05:01:49AM +0000, security-team-toolbox-bot@xxxxxxxxxxxxx wrote:
>>New CVEs affecting packages used to build upstream based rocks have been
>>created in the Ubuntu CVE tracker:
>>
>>* https://github.com/gogo/protobuf:
>>* https://github.com/hashicorp/consul: CVE-2022-29153
>>* https://github.com/prometheus/prometheus:
>>
>>Please review your rock to understand if it is affected by these CVEs.
>>
>>Thank you for your rock and for attending to this matter.
>>
>>References:
>>https://git.launchpad.net/ubuntu-cve-tracker/tree/active/CVE-2022-29153
>>
>>
>>
>> -- 
>>Mailing list: https://launchpad.net/~ubuntu-docker-images
>>Post to     : ubuntu-docker-images@xxxxxxxxxxxxxxxxxxx
>>Unsubscribe : https://launchpad.net/~ubuntu-docker-images
>>More help   : https://help.launchpad.net/ListHelp
>
> The new telegraf 22.04 ROCK does not ship the affected version of
> consul.
>
> While the cortex ROCK does use a consul version that is affected by this
> CVE, it only ships the consul/api client package, which is not affected
> by the CVE.
>
> No actions should be needed from our end here.

Thanks for the checking this, Athos.

-- 
Sergio
GPG key ID: E92F D0B3 6B14 F1F4 D8E0  EB2F 106D A1C8 C3CB BF14